By Keri Forsythe-Stephens
In the wake of a June 1 cyberattack that forced Central Maine Healthcare to shut down its systems, a leading cybersecurity expert is sounding the alarm: regional and midsized hospitals remain dangerously vulnerable to increasingly sophisticated threats.
Central Maine Healthcare confirmed the breach, noting that “unusual activity” was detected on June 1, prompting an immediate shutdown of all IT systems — including servers, phones, and applications.
Ad Statistics
Times Displayed: 35834
Times Visited: 967 Stay up to date with the latest training to fix, troubleshoot, and maintain your critical care devices. GE HealthCare offers multiple training formats to empower teams and expand knowledge, saving you time and money
But this incident reflects a broader and more troubling trend, warns Axel Wirth, chief security strategist at MedCrypt. Ransomware attacks are no longer just frequent—they’re evolving. Yet outdated systems, he says, aren’t the real issue.
“The specific gaps and challenges range from strategic — understanding and governing cyber risks — to organizational, like finding budget and talent, to technical hurdles, including the sheer complexity and number of systems, and the prevalence of legacy devices,” Wirth says.
The healthcare sector’s appeal to cybercriminals is no accident. Weak security postures, fragmented infrastructure, and the urgency to resume operations make hospitals prime targets. Paying a ransom often seems like the fastest path back online.
Federal data backs up Wirth’s concerns: since 2015, hacking-related incidents in healthcare have surged, underscoring the need for a unified, security-first approach across the industry.
The legacy system dilemma
Modernizing aging infrastructure remains one of healthcare’s most critical, and complex, tasks. But before hospitals can act, they need a clear picture of their vulnerabilities.
Risk visibility is the first step, Wirth says. Hospitals must identify and classify legacy systems, assess the cyber risks they pose, and prioritize countermeasures. “Once the risks have been identified and prioritized, devices can be included in the organization’s replacement planning efforts,” Wirth says.
But the solution goes beyond technology. Long-term budgeting, executive buy-in, and risk-based planning are essential. Cybersecurity must be a core requirement of every new equipment purchase—not an afterthought.
HTM and IT: A crucial collaboration
